A password on a file is a second lock. Even if the wrong person gets your share link, they open an encrypted archive and hit a wall. For genuinely sensitive files - Contracts with salary figures, ID documents, financial statements - That second lock is worth the extra two minutes.

The best part: you don't need to buy anything. Windows, macOS, and both major phone platforms can all produce an encrypted, password-protected zip with free tools. The encrypted file then travels safely through any sharing service, because the service only ever sees scrambled data.

Below: the exact steps for each platform, the rule most people get wrong, and when you can skip the password entirely.

Key takeaways

  • Choose AES-256 when you encrypt; the default ZipCrypto is weak and can be cracked in hours.
  • On Mac, zip -e uses weak legacy encryption, so use 7-Zip's 7zz port for true AES-256.
  • Send the password over a different channel than the link (out-of-band), and use 12+ characters or a 4-word passphrase.
  • For routine files, a random link that expires in 1 or 24 hours is protection enough without a password.

Windows: 7-Zip With AES-256

Windows' built-in zip tool can't encrypt, so grab 7-Zip - Free, open source, about a 1.5 MB download.

  1. Select your files, right-click, and choose 7-Zip → Add to archive…
  2. Set Archive format to zip (so any recipient can open it) or 7z (slightly stronger container, needs 7-Zip or similar to open).
  3. In the Encryption box, type a strong password.
  4. Set Encryption method to AES-256. This is the step people miss - The default "ZipCrypto" is weak and crackable.
  5. If you chose 7z format, also check Encrypt file names so snoopers can't even see what the archive contains.
  6. Click OK. Upload the resulting archive, not the originals.

macOS: Two Built-In Options

No download needed on a Mac - Open Terminal and use either of these.

Option A: The Quick zip -e Command

Option A: zip -e (simple, works everywhere):

zip -e archive.zip contract.pdf photos/*.jpg

You'll be prompted for a password twice. Caveat: this uses legacy zip encryption, which is weak - Fine as a casual privacy screen, not for truly sensitive data.

Option B: 7-Zip for Real Strength

Option B: for real strength, install 7-Zip's Mac port via Homebrew (brew install sevenzip) and run:

7zz a -tzip -mem=AES256 -p archive.zip contract.pdf

That gives you the same AES-256 protection as on Windows, in a standard zip any platform can open. (macOS also has ditto for zipping, but like Finder's "Compress" it doesn't support passwords - Use it only when you don't need encryption.)

Phones: Free Apps That Do the Same Job

  • Android: ZArchiver or RAR (both free). Select files → create archive → choose zip → set a password → pick AES-256 where offered.
  • iPhone/iPad: iZip or Zip & RAR from the App Store; both can create password-protected zips from the share sheet in a few taps.

Tip: Pick zip format when you are unsure what your recipient uses, since it opens with tools already on most devices. Reserve 7z for when you also need to hide the file names inside.

Once the encrypted archive exists, share it like any file - On ShareIt.onl you can upload up to 10 files or 200 MB total, get a short link plus QR code with no sign-up, and let the link expire on its own. The basics of that flow are covered in how to share files online.

The Golden Rule: Two Separate Channels

Here's where most people undo their own good work: they email the link and the password in the same message. Now anyone who reads that one email has both the lock and the key. The password added nothing.

The fix is called out-of-band delivery - Send the password over a different channel than the link:

  • Link by email → password by text message or phone call.
  • Link in Slack → password via WhatsApp or Signal.
  • Link in chat → password spoken in person or on a video call.

Now an attacker needs to compromise two separate accounts to get in, which is a dramatically higher bar. Two more habits that help:

  • Use a real password: 12+ characters or a 4-word passphrase like orbit-mango-cliff-42. AES-256 is only as strong as the password guarding it.
  • Never reuse a password you use anywhere else - The recipient will see this one in plain text.
  • Don't put the password in the file name or the message subject line.

The Honest Limits of Zip Encryption

Password-protected zips are a good tool, not a magic one. Know the fine print:

  • ZipCrypto is broken. The legacy zip encryption (the default in some tools, and what macOS zip -e uses) can often be cracked in hours with free software. Always choose AES-256 when the option exists.
  • File names may be visible. In an encrypted standard zip, anyone can list the file names inside without the password - Only the contents are scrambled. If the names themselves are sensitive ("severance-agreement-jsmith.pdf"), use 7z format with the "encrypt file names" option.
  • Weak passwords defeat strong encryption. AES-256 with the password 1234 falls in seconds to a dictionary attack on the downloaded archive.
  • The recipient's device is now the weak point. Once they extract the files, copies live unencrypted on their machine. Encryption protects the file in transit and in storage, not after opening.

For the highest-stakes material, a zip is a solid layer but a dedicated end-to-end encrypted tool may fit better - Our secure file sharing guide explains where that line sits.

Passwords add friction on both ends, and not every file earns it. For routine shares - Event photos, a slide deck, a public brochure, a video too big for email - A random unguessable link that expires in 1 or 24 hours already covers the realistic risks. Nobody can guess the URL, and by the time the link could spread anywhere, it's dead. The reasoning behind that is laid out in why expiring links are safer.

A simple two-question test: Would a leak actually harm someone? and Will the link outlive its purpose? If both answers are no, a 1-hour or 24-hour link alone is fine. If either answer is yes, spend the two minutes: AES-256 zip, short expiry, password by a second channel.

FAQ

Can the sharing service see inside my password-protected zip?
No. If you encrypted with AES-256, the service stores only scrambled data and never has the password. It can see the archive's file name and size, and - With standard zip format - The names of files inside, which is why 7z with encrypted file names is better for sensitive material.
Is the password protection on a zip file actually strong?
With AES-256 and a strong password (12+ characters or a multi-word passphrase), yes - Brute-forcing it is not practical. With legacy ZipCrypto or a short password, no; those can be cracked offline with free tools. The settings you pick matter more than the zip format itself.
Why shouldn't I send the password in the same email as the link?
Because then one compromised inbox, one wrong recipient, or one forwarded message exposes both at once, and the password added zero protection. Sending it by text, phone, or a different app means an attacker must break into two separate channels.
Do I need a password if my link expires in an hour?
Usually not, for everyday files - A random link with a 1-hour lifespan gives an attacker almost no window and nothing to find afterward. Add the password when the content could genuinely harm someone if leaked, or when the link needs to live for days.